This is exactly what set OpenBSD back in the early 2000s.

https://www.zdnet.com/article/defense-agency-pulls-openbsd-f...

Maybe that $500k that was earmarked for OpenSSL vulnerability testing would have found Heartbleed.